PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6476 PostgreSQL CVE debrief

A SQL injection vulnerability in PostgreSQL's pg_createsubscriber function allows authenticated attackers with pg_create_subscription rights to execute arbitrary SQL commands with superuser privileges. The vulnerability affects PostgreSQL versions 17.0 through 17.9 and 18.0 through 18.3; versions prior to 17.0 are unaffected. The attack vector requires network access and low attack complexity, but high privileges (pg_create_subscription rights). Successful exploitation results in complete confidentiality, integrity, and availability compromise of the database server. The vulnerability was published on 2026-05-14 and last modified on 2026-05-18. No known exploitation in ransomware campaigns has been reported.

Vendor
PostgreSQL
Product
PostgreSQL
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-18
Advisory published
2026-05-14
Advisory updated
2026-05-18

Who should care

Database administrators managing PostgreSQL 17.x or 18.x installations; security teams responsible for database infrastructure; organizations using logical replication with subscription creation capabilities; compliance officers tracking privilege escalation vulnerabilities in database systems

Technical summary

The pg_createsubscriber function in PostgreSQL contains a SQL injection vulnerability that allows attackers with pg_create_subscription rights to inject and execute arbitrary SQL statements. When pg_createsubscriber is next invoked, the injected SQL executes with superuser privileges, granting complete control over the database instance. The vulnerability stems from improper input sanitization within the function's SQL construction logic. Affected versions include PostgreSQL 17.0 through 17.9 and 18.0 through 18.3. The CVSS 3.1 base score of 7.2 reflects high impact (confidentiality, integrity, availability) balanced against high privilege requirements for exploitation.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade PostgreSQL to version 17.10 or later for version 17.x installations, or version 18.4 or later for version 18.x installations
  • Audit database user accounts and revoke pg_create_subscription privileges from non-essential accounts pending patch deployment
  • Monitor database logs for anomalous pg_createsubscriber execution patterns and unexpected superuser-level operations
  • Review and restrict network access to PostgreSQL instances to authorized administrative hosts only
  • Verify backup integrity and ensure recovery procedures are tested before applying updates in production environments

Evidence notes

Vulnerability confirmed through NVD analysis with vendor advisory from PostgreSQL. CVSS 3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. CWE-89 (SQL Injection) classification provided by vendor reference.

Official resources

2026-05-14T14:16:25.230Z